Posted
by
timothy
on Friday June 25, 2010 @09:51PM
from the coming-and-going dept.

Trailrunner7 writes "The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn't the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on users' phones as well. Jon Oberheide, the security researcher who developed the application that Google remotely removed from Android phones, noticed during his research that the Android OS includes a feature called INSTALL_ASSET that allows Google to remotely install applications on users' phones. 'I don't know what design decision they based that on. Maybe they just figured since they had the removal mechanism, it's easy to have the install mechanism too,' Oberheide said in an interview. 'I don't know if they've used it yet.'"

How long until someone exploits this? Well, I bet Google or some other vendor will try to sell it as part of an offering for businesses within the next 2 years. Remote software installs would be very useful in the enterprise.

I think that remote anything should be opt-in by the user, or, in an enterprise setting, should be added on by the enterprise before distributing the units. I do not welcome the idea that *all* Android handsets will have remote add/remove package functionality out of the box, for all users.

Imagine the fun law enforcement and government agencies will have with this. Remote install app that silently forwards mic input to an eavesdropper.

Is there even a way to turn this feature off? I.e., lets say I buy a handset and I definitely do *not* want Google nuking my apps remotely or adding apps to my phone remotely without my knowledge.

This is the reason that I think the FOSS community should back MeeGo. It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.

Meh, they have that kind of software for almost all phones. http://flexispy.com/ [flexispy.com] and plenty others, I'm sure.

I suppose it might be nefarious that they don't even need physical access to your phone to install it. But the install feature probably asks for user confirmation before receiving a "push" install from your carrier, just like my cheap Samsung dumbphone.

If you really want control, I suppose you could put http://www.cyanogenmod.com/ [cyanogenmod.com] on your Android phone. Is that affected?

Not to mention, google already announced you will be using this feature before.
If you haven't seen this years google I/O then I'll tell you: you will be able to install apps on your phone from any device in the cloud.

And besides, it's not like google is targeting you specificaly, they target all phones with that app installed. The purpose of it is to remove a malicious app before it can do any more damage.

Example: I make an app branded as a porn site viewer, it works as one but it also sends information gathered from your sdcard/phone for some nefarious deeds. Removing it from the market would stop the app from spreading, but it has already been installed on thousands of phones, setting a flag on the market for "uninstall from phone NOW" would fix this.

I know google could be more gentle about it and warn the user and ask for the app to be removed, but it's not like they use it on every app that pisses them, only on those that disregard their stated rules. So far google has been following the rules, so articles like this are just spreading FUD.

It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.

Although I get your point, I'd say the Many Eyeballs principle is working with Android, given that this article exists.

MeeGo also has the advantage of not reinventing the entire userspace, thus remaining closer to what we generally consider a GNU/Linux system. Android is quite slick in practice but it does upset me that it's so non-standard in every possible way:-(

Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?

IBM, grasshopper, Microsoft used to be the new IBM. Learn your history!

Microsoft was never the new anything. They basically invented the business model of selling software to hardware vendors, so anyone that replaces them in that capacity is the new Microsoft, but they are the original. This was never IBM's market.

Well, that's essentially how we are taking this news, right? Same difference, but Android users don't need the more colorful language to comprehend what's going on. The reporting was spot on, and we get it, without alarmism.

A new OS version or patch, sure. An app, not so much. My Android phones doesn't OTA update without prompting me and me approving it. The meat of the article, in my understanding, is that they have a function that will automagically install or remove an app without user interaction. Is that not correct?

A new OS version or patch, sure. An app, not so much. My Android phones doesn't OTA update without prompting me and me approving it. The meat of the article, in my understanding, is that they have a function that will automagically install or remove an app without user interaction. Is that not correct?

As far as I can tell, Yes.
One instance I could see/understand is for this is Google provided programs that are included with the phone (Maps, Gmail, Browser, ext) being forced to a newer version.

Actually, according to a talk by Rich Cannings, Google's "Android Security Leader", at Usenix Security '09 in Montreal, Google can choose whether or not to have your phone ask you for permission for an OS upgrade. If they think it's important enough, they reserve the "right", and definitely retain the technical capability, to install an upgrade without asking. The carriers can probably also do OTA upgrades on their own initiative; that part wasn't clear to me.

The whole tone of his talk was scary. There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone, or that such distrust could possibly be legitimate if it did exist. His whole attitude reeked of "we know better than you do", and he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy. And he didn't even mention the possibility that Google might get compromised.

He also seemed to think of the Android open source project as something to push code to as an afterthought, rather less important than the carriers... whose interests he seemed to think were terribly, terribly important.

It was not reassuring.

And, yes, my understanding matches yours. The article says that they can also install apps, in addition to OTA OS upgrades. In fact, as I read the supporting material, the Market application works by pushing an "INSTALL_ASSET" message to your phone... the same message they'd use to spontaneously install an app. So there's no fixing the problem without either disabling the Market entirely or patching the implementing code.

And of course an OS upgrade could contain code to do anything they want, including enabling them to install apps if they weren't already able to do so.

...he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy.

To be fair, he does have a point, if in fact that was his view. I mean, how many zombified PCs are out there now, DDoSing servers and spamming the planet, just because their owners can't manage (at a bare minimum) to enable Automatic Updates? Millions? Tens of millions?

I know hating Google is in vogue these days, but let's be honest here: so far, they're no Microsoft. They're not a convicted monopoly; they've gone out of their way to invest real resources in opening their services, actually spending money to make it easier for people to migrate away from Gmail and Google Docs; they sponsor and promote open source; and they compete by constantly making their products better, rather than trying to strong-arm people into buying their junk. So yeah, until they show otherwise, I'm going to be cautiously optimistic and give them the benefit of the doubt.

The question is, is there a way for paranoid individuals to turn this capability off if they want to. Let the Joe Sixpacks of the world live in blissful ignorance, and let Google keep them from bringing the cell networks down with their inability to properly patch and protect their phones; just give me the ability to opt out if I know the risks, and choose to take them.

The question is, is there a way for paranoid individuals to turn this capability off if they want to.

There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones. If the question is "does Google or the owner know better whether or not something should be installed?" the answer can't be "Google, but they should make a checkbox that says 'lulz just kidding, I'm smarter, turn it off.'" It's

The question is, is there a way for paranoid individuals to turn this capability off if they want to.

There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones.

There should be, for the reason that only some users are a security threat (as described in GP, the ones whose PCs are DDOS-bots and such) while others are not (those of us who update regularly and don't run untrusted executable downloads or other shifty things).

If the question is "does Google or the owner know better whether or not something should be installed?" the answer can't be "Google, but they should make a checkbox that says 'lulz just kidding, I'm smarter, turn it off.'" It's not logically consistent.

It's not logically consistent only if you assume all users are identical. isn't it more reasonable to say that Google is better at deciding than those users who never figure out where the check box is or never care enough to check it, and Google is

How is that not consistent? For the vast majority of users, a phone is an appliance, just like a PC is an appliance, or a refrigerator, or a car. They don't know what is involved in maintaining that phone, or the security risks associated with using the phone, nor are they particularly inclined to care; they have more important things to do with their lives, like hold down a job, take care of kids, keep up with politics to be a better informed voter, etc. For these sorts of people, whom I suspect makes up a

There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone,

There's no such thing as trusting them with partial control of your phone because if they can push anything to your phone they can probably root it. So either install your own distribution of Android (perhaps CM) and disable this functionality or accept that others will be helping you manage your phone.

Just because the updates which have come out already have asked you to update doesn't mean that is a prerequisite. You are implying ("An app, not so much.") that other phones can't update an app. Not true. "Every other phone" allows carriers to to do over the air updates. If they want to do an app, they can, by pushing a full image which includes that app. That Android is more modular, and allows_just_ an app to be pushed should be considered a benefit, as it allows a less risky way of updating things. Whet

my old blackberry had a similar feature; which was often exploited by verizon wireless to push icons for new apps and services to my phone without my permission and there was nothing i could do about it...

Dang it, I'm much happier with T-Mobile (except for the lack of 3G at home) than I ever was with AT&T, but now I really want an N900 (even more than I did yesterday). I've also been considering switching to Credo Mobile, since the liberal-progressive/ethical niche they've been claiming suits my own beliefs. Just not sure about using a smaller company, even though they apparently use Sprint's network, or shelling out a bunch for a new phone when I'm mostly happy with mine. Too much information! Go back!!

Seriously, this is a worthwhile point. Maemo (OS on the N900) *IS* Linux, not a fancy face on top of it that takes away your control. The default user is not root, but you can become root. The package manager software is setuid root, but you can fix that if you want to make it impossible to install apps without entering a password.

Which is just about the same as Android, then. Google releases the Android source so you could patch the install mechanism if you wanted to. I'm root on my Nexus 1 - that is basically just a command away.

The thing is, just because I am root and has access to the source code doesn't mean there aren't backdoors that hasn't been detected yet. I don't see how Maemo is different in that regard. Or say, Ubuntu. There COULD be a hidden backdoor somewhere, cleverly obfuscated for when Mark Shuttleworth wants to tak

Well the process would be just as hard on Android but he isn't running Android.His phone has an officially supported root mode. The root mode isn't killed by updates. It doesn't stop the updates from working. Nor does it prevent you using any applications you could use before like the app store. It doesn't void your warranty. It doesn't require a re-flash.

So no, the process of getting root for you wasn't as easy for you as it was for the GP.

I'm guessing that you're in the US, in that case. My carrier can push updates to the SIM card (which they provided), but they don't even get told what kind of phone I'm using and there is no feature for them to push updates to it. Even SIM updates require me to permit them, although if I don't then (theoretically, at least), my phone could lose the ability to connect to the network.

The difference is, an App could very well be a part of the OS (for example the browser) it just isn't part of the Kernel/UI. A critical flaw in the browser certainly warrants a quick update. Plus, OS updates might not always come to phones. With no OS level updates coming to some phones due to manufacture/carrier apathy vulnerabilities need to be fixed somehow, and OTA updates are a good way of doing it for phones who can't support the new technologies with new Android versions.

Really, this makes a bit more sense than having 234234234324234 OS updates every year. The majority of updates can be done by removing/updating apps, not to mention security patches. Really, some phones already have the latest Android they will ever get, barring rooting. But people will keep using that phone for 4+ years, that is a long time to have a security flaw out there that could steal information. Since the browser is going to be the main attack vector which is an app, it makes sense.

While this could be used to push more carrier crapware, I think updates and upgrades of installed apps are more likely to work for more phones and easier for the average user to use.

In all honesty, would you rather be using an outdated version of a browser with security flaws because your phone doesn't support Android 2.75 Double Chocolate Chunk Cookie or just have your browser update to a more secure version OTA?

Ok, so Google can install new apps to give new features? Not really sure what I should be worried about... Yes I know they -could- install in new applications which are completely evil provided by Sprint/T-Mobile/Verizon/AT&T but I'm not sure if Google would end up doing that because carriers really hold back Android more than anything else.

There is competition now in the phone market, Google doesn't want to screw up anything because I could go to iOS, BlackBerry OS, WinMobile, Symbian, or heck, I c

But Google won't see a point in installing crapware OTA. Google has no "YOU MUST DO THINGS OUR WAY" like Apple does, Google also is blocked from really innovating because of the carriers, I have little doubt in my mind that if Google didn't think that carriers would make a huge deal about it, Android would have tethering from the beginning and a lot of other features.

If worse comes to worse I have little doubt in my mind that Google will keep top-tier phones free from crap similar to the Nexus One and t

like Apple does ? Apple is clear about its installer and updates.
Google has just been noted for its push and pull reach. Something that the open source community seems to view as very DRM, Apple, Sony, MS like.
Apple, Sony, MS may talk about open code and have set views on it, but Google actively uses it for the total OS look and feel.
Thats why this is so interesting. Messing with a users phone in both directions, install and removal is something new.
Google seems to be doing fine in innovating too wit

Yep, because google's not an advertising company, and would never want to, say, install an app that brings you the "great new feature" of automatically pinging their servers with a GPS coordinate and downloading location-relevant ads right to your phone!

Point is - you aren't offered a choice. Point is - you aren't being asked, "is it okay if we do this?" I don't care what the feature is, I'd take severe issue with someone deciding, "here you need this." And let's be honest - updates aren't always flawless... if Google bricks my phone accidentally, will I be able to recover any important data I might have had on there?

If you aren't making backups, your data is more vulnerable to a toilet than it is to Google. Google's ads are GPS-sensitive... if you decide to give the browser access to your location information. It's actually pretty well done, and hey, it's open-source. If you don't like it, compile a copy yourself without that stuff. Or get someone else to... there are lots of android hackers out there.

... if you decide to give the browser access to your location information. It's actually pretty well done, and hey, it's open-source. If you don't like it, compile a copy yourself without that stuff...

Which will work great...UNTIL they remotely force your phone to download an identical version with all the stuff you took out back in, without your knowledge or consent, like this "feature" allows them to do at will. Isn't that the point of this whole discussion?

Does anyone remember the android demo at Google IO where they showed the remote install feature from the android market on a desktop browser in froyo? Seriously, just because there is remote install functionality in the OS doesn't mean that it's there for malicious or secret use -- it's most likely part of a user facing feature.

What it means is that it there for use. Good or bad don't enter into it, it's a capability.

Once you realize that the capability is there, you can make an informed decision. (Personally, I've decided that I'm not buying an Android either. I've already made this decision about many other platforms, but I had been thinking about getting an android.)

It's coming up to time to decide on a new phone. It looks like I'll be going with the cheapest one again rather than buying a fancy one. But there are still a

Seriously, just because there is remote install functionality in the OS doesn't mean that it's there for malicious or secret use -- it's most likely part of a user facing feature.

For the most part, I trust Google, T-Mobile, and even Microsoft. I don't question their intentions, or their desire to keep us and the networks as secure as is reasonably possible. But sometimes things go awry, and capabilities for remotely forced installs could of course theoretically be co-opted by someone with more malicious

This is incorrect. Most of android is in AOSP, including the kernel, dalvik, UI, launcher, dialer, all the libs etc. You can build a fully working system from the open source components (that's how cyanogenmod is built).

Only the google-specific applications (Maps, gmail, gtalk, google market, facebook, google voice ) are not open source. Many of them can be replaced with alternatives if one wants to release a system without paying to google: e.g. SlideMe market, one of many different e-mail/gps apps, etc.

I'm not trying to troll, but really. if you compare the the two platforms one is mostly open and one is glued shut.

I'm not trying to troll, but really; if you compare the two platforms one is mostly bought and paid for by the handset purchaser, the other is free to the consumer and OEM but is distributed with the intent of selling mobile eyeballs to advertisers. What could possibly go wrong?

Exactly my thought. It's not like Google has never found their servers compromised by China, for example. I'm surprised that the US government isn't a little concerned that Google has just potentially handed China the ability to turn every single Android phone into a bug. I wonder if this is part of the reason why GCHQ does not permit Android phones for government use in the UK...

I'm sure someone could create a honeypot wifi network that forces all Android devices that connect to it to install a particular app.

Not unless they manage to compromise SSL in order to make the phone think it's talking to Google when it really isn't. If someone manages to do that, we have much bigger things to worry about than a malicious phone app.

Such flaws are why professional developers do not put in random features that can be exploited. Sure it might be fun toi say that our application has a thousand more features than the competition, but to those that are savvy it is just a thousand more way to be put at risk.

Actually, this moves android from "my next phone" to a "definite maybe".

I do NOT like back doors. This makes the SSL Cert that would be used to prove one is google a very valuable target indeed. It really makes me wonder if it is a question of "if" or "when". On top of that, why should I trust google with this? If something needs to be installed, on MY PHONE, I want to be, at least, asked.

My suggestion is that you rely on a land line phone then (were I that worried over it I would go with a vintage rotary phone too - no computer to futz with). All cell phones I know of can add or remove features without your permission. Some may choose not to do so, some may regularly do it, but they all do. Even worse an iPhone, Blackberry, or an Android are *not* phones, they are handheld computers that just so happen to have a cellular device attached to them. You LG flip phone that has no apps other than

Actually, this moves android from "my next phone" to a "definite maybe".

I do NOT like back doors.

You always have the option to root your phone and install a third-party build of Android that doesn't have this feature. (Unlike a certain other company, Google doesn't claim that you'd be breaking the law by doing so.)

This makes the SSL Cert that would be used to prove one is google a very valuable target indeed.

As if it isn't already? If you can impersonate Google, you can access everyone's Gmail, AdSense, AdWords, Docs, etc.

Yeah because wardriving is soooo terrible. Look, if you don't want people connecting to your wi-fi network hide the SSD and encrypt it securely. If not, then does it matter too much if you lose a few bytes of data? There are very, very, few people who are going to bother even trying to break an encrypted connection, especially when they can go to a cafe and get free internet pretty much everywhere.

Look, if you don't want people connecting to your wi-fi network hide the SSD and encrypt it securely

Encrypt it with what, WEP? That would help just as much as not broadcasting your ssid (and, for that matter, as much as MAC filtering). Honestly, these three approaches to "security" won't stop anyone who knows how to book a BackTrack liveCD.

Depending upon the specifics, it's not that much more secure than WEP was when it was introduced. I think the take home on that is that perhaps involving qualified crypto experts and security experts to design that part of the specification is a good thing. Sure it's never going to be 100% secure, but it's almost laughable how quickly the protection turns out to be easily breached.

You're just flat wrong. WPA isn't compromised in any way even remotely as badly as WEP was/is.

WPA:TKIP can, in certain cases with certain AP's allow one to inject packets into the network. Packets won't come back to the attacker.Perhaps one can use that as a way to leverage some additional resources to attack a network. Certainly, I wouldn't feel good with someone being able to inject packets - but it's not a game-over exploit like WEP was.

WPA-AES: There's simply no known attack against the cypher. You might be able to brute-force the key - but that's an issue of any shared-secret system - it doesn't have anything to do with the crypto in WPA:AES. The solution is to use a large key-space (all ascii characters, not just uppercase alpha's for example.) and long-ish. 10 chars or more. Bonus points for more random and less guessable secrets.

So, IMO, to claim "...it's not that much more secure than WEP was when it was introduced." is really a massive overstatement due to ignorance, at best or just plain falsehoods at worst.

Yeah, and really how many people do you think are going to bother? Lets face it, there are a lot easier targets out there to hack for some script kiddie. For a really, really good black hat cracker they'd need some kind of personal motivation (such as bragging that your network at XXXX address is unhackable) for them to bother.

Lets face it, chances are your neighbors aren't 1337 h@x0rz who are just looking to get into your router and redirect all requests to Goatse, the guy out in his car just wants fre

Google wanted control so they pushed http://en.wikipedia.org/wiki/Android_(operating_system) [wikipedia.org]
GPLv2 to bait you in, Apache 2.0 to close you down if needed.
You write the 'free' apps, hunt bugs, preach about the 'freedoms', Google tracks, sells ads, data mines, a push and profit with a sting in the tail it seems.

Hmm, I'm sure the indie ROM folks are working on this already. I've so far resisted screwing around with my G1, though I've thought about it. This makes me want to root and go with a non-standard firmware, if it will keep my phone mine.